Bump docker/setup-buildx-action from 3.12.0 to 4.1.0

[dependabot]

Bumps docker/setup-buildx-action from 3.12.0 to 4.1.0.

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.1.0

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in docker/setup-buildx-action#489
• Bump brace-expansion from 1.1.12 to 5.0.6 in docker/setup-buildx-action#547 docker/setup-buildx-action#508
• Bump fast-xml-builder from 1.0.0 to 1.2.0 in docker/setup-buildx-action#540
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in docker/setup-buildx-action#496
• Bump flatted from 3.3.3 to 3.4.2 in docker/setup-buildx-action#499
• Bump glob from 10.3.12 to 13.0.6 in docker/setup-buildx-action#495
• Bump handlebars from 4.7.8 to 4.7.9 in docker/setup-buildx-action#504
• Bump lodash from 4.17.23 to 4.18.1 in docker/setup-buildx-action#523
• Bump picomatch from 4.0.3 to 4.0.4 in docker/setup-buildx-action#503
• Bump postcss from 8.5.6 to 8.5.10 in docker/setup-buildx-action#537
• Bump tar from 6.2.1 to 7.5.15 in docker/setup-buildx-action#545
• Bump undici from 6.23.0 to 6.25.0 in docker/setup-buildx-action#492
• Bump vite from 7.3.1 to 7.3.2 in docker/setup-buildx-action#520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

v4.0.0

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in docker/setup-buildx-action#483
• Remove deprecated inputs/outputs by @​crazy-max in docker/setup-buildx-action#464
• Switch to ESM and update config/test wiring by @​crazy-max in docker/setup-buildx-action#481
• Bump @​actions/core from 1.11.1 to 3.0.0 in docker/setup-buildx-action#475
• Bump @​docker/actions-toolkit from 0.63.0 to 0.79.0 in docker/setup-buildx-action#482 docker/setup-buildx-action#485
• Bump js-yaml from 4.1.0 to 4.1.1 in docker/setup-buildx-action#452
• Bump lodash from 4.17.21 to 4.17.23 in docker/setup-buildx-action#472
• Bump minimatch from 3.1.2 to 3.1.5 in docker/setup-buildx-action#480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

Commits

• d7f5e7f Merge pull request #489 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 92bc5c9 chore: update generated content
• da11e35 build(deps): bump @​docker/actions-toolkit from 0.79.0 to 0.90.0
• f021e16 Merge pull request #492 from docker/dependabot/npm_and_yarn/undici-6.24.1
• b5af94f chore: update generated content
• 16ad977 build(deps): bump undici from 6.23.0 to 6.25.0
• d7a12d7 Merge pull request #495 from docker/dependabot/npm_and_yarn/glob-10.5.0
• 28ff27d build(deps): bump glob from 10.3.12 to 13.0.6
• daf436b Merge pull request #496 from docker/dependabot/npm_and_yarn/fast-xml-parser-5...
• 9725348 chore: update generated content
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[superagent-security]

Superagent found 2 security concern(s).

[superagent-security]

P1: Third-party action is pinned to a mutable tag in publish workflow

docker/setup-buildx-action@v4.1.0 is tag-pinned, not SHA-pinned.

Replace the tag with the release commit SHA plus a version comment.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name=".github/workflows/publish.yaml">
<violation number="1" location=".github/workflows/publish.yaml:72">
<priority>P1</priority>
<title>Third-party action is pinned to a mutable tag in publish workflow</title>
<evidence>The modified Buildx setup step uses `docker/setup-buildx-action@v4.1.0`. GitHub Action tags are mutable; if the action repository or tag is compromised or force-moved, this publish workflow would execute different code without any change in this repository.</evidence>
<recommendation>Pin the action to the full 40-character commit SHA for the intended `v4.1.0` release and keep the version as a comment, for example: `uses: docker/setup-buildx-action@&lt;40-char-sha&gt; # v4.1.0`. Apply the same pinning policy to all actions in the release/publish path.</recommendation>
</violation>
</file>

[superagent-security]

P1: Second Buildx setup step is also pinned to a mutable tag

Second docker/setup-buildx-action@v4.1.0 is tag-pinned.

Use a full commit SHA instead of the version tag.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name=".github/workflows/publish.yaml">
<violation number="1" location=".github/workflows/publish.yaml:165">
<priority>P1</priority>
<title>Second Buildx setup step is also pinned to a mutable tag</title>
<evidence>A second modified Buildx setup step also uses `docker/setup-buildx-action@v4.1.0`. In a publish workflow, mutable action tags are a supply-chain risk because the workflow may build or publish release artifacts using code fetched from a tag that can change outside this repository's review process.</evidence>
<recommendation>Pin this `docker/setup-buildx-action` invocation to the full 40-character commit SHA for the intended `v4.1.0` release and retain `# v4.1.0` as a comment for reviewability.</recommendation>
</violation>
</file>